CVE-2016-7253

HIGH

Microsoft SQL Server 2012 SP2-SP3, 2014 SP1-SP2, 2016 - Authenticated Privilege Escalation via atxcore.dll ACL

Title source: llm

Description

The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1037250

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94056

Scores

CVSS v3 8.8

EPSS 0.1186

EPSS Percentile 95.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-264

Status published

Products (2)

microsoft/sql_server 2012 sp2 (2 CPE variants)

microsoft/sql_server 2014 sp1 (2 CPE variants)

Published Nov 10, 2016

Tracked Since Feb 18, 2026